CVE-2024-2541

Name of the Vulnerable Software and Affected Versions Popup Builder plugin for WordPress versions up to, and including, 4.3.3

Description The issue is a Sensitive Information Exposure vulnerability in the Popup Builder plugin for WordPress, specifically via the Subscribers Import feature. This allows unauthenticated attackers to extract sensitive data, including first name, last name, e-mail address, and potentially other personally identifiable information of subscribers, after an administrator has imported subscribers via a CSV file.

Recommendations For versions up to, and including, 4.3.3, update the plugin to the latest patched version immediately to prevent sensitive information exposure. As a temporary workaround, consider restricting access to the Subscribers Import feature until the update is applied.